Description
Suite CRM version 7.14.2 allows making arbitrary HTTP requests through
the vulnerable server. This is possible because the application is vulnerable
to SSRF.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Suite CRM | Suite CRM | 7.14.2 | — |
References
- https://fluidattacks.com/advisories/leon/ third-party-advisory
- https://github.com/salesagility/SuiteCRM/ product
- https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_4 patch